<13> added to beginning of message

Elastic Stack Logstash
1

I have two very different inputs (syslog & exchange message tracking logs) coming from different servers going into different input/filter/output configs in logstash.

Both of these have <13> added to the start of each message when being ingested into logstash and i can't find where it's coming from.

Looking at the stdoutput of the logs, it's in the message when it reaches logstash.
I haven't performed a tcpdump to see if it's in the actual message, that'll be the next step. But does anyone have any clue why this is being added?

I have a few other different inputs that don't get this added.

2

The <13> is part of the syslog protocol and encodes the message's facility and severity.

3

Thanks. I came to the same conclusion shortly after posting as well.

The Exchange logs were shipped with nxlog which had to_syslog_bsd() in it's config. Removing this removed the <13>

And your info makes the syslog appearance almost 'to be expected'.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.